Personal data protection notice
Effective 1 November 2026 · version privacy-2026-11-01
This English version is provided for convenience; the Thai version (/privacy/) is the binding text.
บริษัท วายเอ็มทีดี การบัญชี พาร์ทเนอร์ จำกัด (YMTD Accounting Partner; “the firm”, “we” or “us”) takes your personal data seriously. This notice explains what the website ymtdaccountingpartner.com collects, what it is used for, who it is disclosed to, how long it is kept and what rights you have, under the Personal Data Protection Act B.E. 2562 (2019) (PDPA).
1. Data controller
- บริษัท วายเอ็มทีดี การบัญชี พาร์ทเนอร์ จำกัด Juristic person registration no. 0505567018407
- Address: 223/100 หมู่บ้านเชียงใหม่วิวสวย 2, San Phak Wan, Hang Dong, Chiang Mai 50230, Thailand
- Email: [email protected] · Tel. 081-542-3019 · LINE premwittawat
This notice applies to data received through the website (the contact form, quote requests, appointment requests, the automated assistant and the fee estimator). Data that clients send to the firm for bookkeeping or tax filing is governed by the service contract and the agreements made separately.
2. Data we collect
We collect only the data needed for your request; most of it comes directly from you.
- Contact and quote forms: your name or business name, one reply channel (phone number, LINE ID or email), business type, the details you type, the service or package selected, the page you came from and the newsletter option
- Appointment requests: the topic you want to discuss, the meeting format and your preferred date and time (Thailand time). The system does not book a slot automatically; our staff will contact you to confirm
- Automated assistant (chat): the messages you type and the system’s replies, and the conversation summary that you review and choose to send to our staff
- Fee estimator: the business details entered for the calculation, such as the business form, VAT registration, number of documents and employees (no name required), and the estimate the system produces
- Technical data: the session cookie, IP address and browser information used to check that you are not a bot and to limit excessive submissions
What not to send through the website: we do not ask for sensitive data (such as religion, health, criminal records or biometric data), national ID numbers, bank account numbers, passwords or financial documents through the form or the chat. If any of these is needed, our staff will ask for it through a channel agreed with you directly.
3. Purposes and legal bases
| Purpose | Legal basis (PDPA) |
|---|---|
| Contacting you back, answering questions, preparing a quote and arranging the appointment you asked for | Steps at your request before entering into a contract (Section 24(3)) |
| Answering chat questions from the service information the firm has confirmed, and sending the summary to our staff when you choose to send it | Steps at your request (Section 24(3)) and our legitimate interest in providing service information (Section 24(5)) |
| Notifying our staff of a new request by email to the firm | Steps at your request (Section 24(3)) |
| Preventing spam, bots, duplicate submissions and abnormal use; keeping the system secure | Legitimate interest (Section 24(5)) |
| Sending the firm’s news and announcements (only when you tick the box) | Consent (Section 19), which you can withdraw at any time |
| Complying with the law, orders of government authorities, or exercising legal claims | Legal obligation (Section 24(6)) and legitimate interest (Section 24(5)) |
If you do not give a name and a reply channel, we cannot contact you back or issue a quote, but you can still use the chat and the estimator without identifying yourself. We do not use your data for automated decisions that have legal effects on you; the fee estimate is a preliminary figure that our staff must always confirm.
4. Recipients and the processors acting for us
- The firm’s staff whose job is to reply to and handle requests
- Cloudflare, Inc., the provider of the website hosting, the database, the bot check (Turnstile) and the notification email service
- Google LLC, the provider of the firm’s mailbox (Gmail) that receives the request notifications, and of the AI service (Gemini API) that processes the text you type in the chat to generate replies (only when you use the chat). The firm uses the paid Gemini API, which under Google’s terms does not use the text to improve its products but keeps logs for a period to detect use that breaches its policies
- Government authorities or persons with legal authority, when disclosure is required by law
The providers above use the data only on the firm’s instructions. We do not sell, rent or disclose your data to third parties for marketing.
5. Transfers abroad
The providers in Section 4 may store or process data on servers outside Thailand, such as in the United States and countries in the Asia-Pacific region. We choose providers with data protection agreements and appropriate security measures, in line with Sections 28 and 29 of the PDPA.
6. Retention periods
The website’s systems delete data automatically after the following periods.
- Contact, quote and appointment requests, including the attached chat summary and estimate: no more than 12 months from the date the request was sent. If you become a client, the data needed to provide the service moves to your client file under the service contract
- Chats not sent to our staff: deleted within 24 hours after the session expires (a session lasts 2 hours)
- Estimates not attached to a request: 90 days
- Technical data: duplicate-submission records 7 days, rate-limit counters 2 days, session records 30 days after expiry, and anonymous usage statistics 395 days
- Notification emails in the firm’s mailbox: the same period as the requests (12 months)
When the period ends, or when you ask for deletion and there is no legal reason to keep the data, we delete it or make it impossible to identify you from it.
7. Your rights
Under the PDPA you have the right to:
- access and obtain a copy of your data
- have your data corrected and kept up to date
- have your data deleted, destroyed or made anonymous
- have the use of your data suspended
- object to the collection, use or disclosure of data that relies on legitimate interest
- receive your data, or have it transferred, in a commonly machine-readable format
- withdraw your consent to receive news at any time, without affecting what was done before the withdrawal
- lodge a complaint with the Office of the Personal Data Protection Committee (PDPC) at www.pdpc.or.th
To exercise these rights, contact us as in Section 1 and quote your reference number (if any). We may ask for information to verify your identity before acting, and will respond within 30 days of receiving the request, free of charge unless the request is repetitive or excessive. If we have to refuse, we will tell you the reason.
8. Security
- HTTPS on every page, and access to request data limited to the staff concerned
- Bot check, rate limiting and duplicate-submission protection; chat messages are not sent to analytics or advertising systems
- If a personal data breach occurs, we will notify the Office of the Personal Data Protection Committee within 72 hours of becoming aware of it, unless there is no risk to your rights, and will inform you together with remedial measures without delay if the risk is high
9. Cookies
The website uses only the cookies necessary for it to work, so no consent is required.
ymtd_sid: the website’s session cookie (HttpOnly, 2-hour lifetime) used to remember the conversation and prevent duplicate submissions; it contains no name or contact details- Cloudflare’s cookies and security signals, including Turnstile, are used only to check that you are not a bot
- The Google map on the About page loads only when you press to open it; after that, Google may set cookies under Google’s policy
The website counts usage anonymously and without cookies in two ways: page views (Cloudflare Web Analytics), and presses of the contact, quote, chat and form-submit buttons, recorded in the website’s own system. It keeps only the event name, the page, the link source and the screen size (mobile/desktop); it does not keep the IP address, browser information, the text you type or anything that identifies you, and it records nothing when the browser sends a Do Not Track or Global Privacy Control signal.
The website currently uses no analytics or advertising cookies. If we start to, we will ask for your consent first and update this notice.
10. Links to other services
When you follow a link to LINE, Facebook, Google Maps, YmtdBuddy or another system, the use of data in those services is governed by that provider’s policy. Please read the policy of each service.
11. Minors
The firm’s services are intended for business operators and persons of legal age. If you are under 20, please have a parent or guardian contact the firm on your behalf.
12. Changes to this notice
We may update this notice when the way we collect or use data changes. The current version shows its effective date and version code at the top, and every request records the version code you acknowledged. If a change concerns something that relies on consent, we will ask for your consent again.